Analysis
- max time kernel
152s - max time network
158s - platform
windows10-2004_x64 - resource
win10v2004-20221111-en - resource tags
- submitted
22/11/2022, 17:46
General
- Target e976a2f97fa0a949a2ac36b89bc81a9f6b64f97bd2745ac951fd695fe53661ea.exe
- Size 483KB
- Sample221122-wcdw5sfc5y
- SHA256 e976a2f97fa0a949a2ac36b89bc81a9f6b64f97bd2745ac951fd695fe53661ea
Malware Config
Signatures
- Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
- Executes dropped EXE 2 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Drops desktop.ini file(s) 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Drops file in Windows directory 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 19 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e976a2f97fa0a949a2ac36b89bc81a9f6b64f97bd2745ac951fd695fe53661ea.exe"C:\Users\Admin\AppData\Local\Temp\e976a2f97fa0a949a2ac36b89bc81a9f6b64f97bd2745ac951fd695fe53661ea.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\CMD.exe"CMD"2⤵
-
-
C:\Windows\SysWOW64\CMD.exe"CMD"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\e976a2f97fa0a949a2ac36b89bc81a9f6b64f97bd2745ac951fd695fe53661ea.exe"C:\Users\Admin\AppData\Local\Temp\e976a2f97fa0a949a2ac36b89bc81a9f6b64f97bd2745ac951fd695fe53661ea.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\e976a2f97fa0a949a2ac36b89bc81a9f6b64f97bd2745ac951fd695fe53661ea.exe"C:\Users\Admin\AppData\Local\Temp\e976a2f97fa0a949a2ac36b89bc81a9f6b64f97bd2745ac951fd695fe53661ea.exe"2⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
e976a2f97fa0a949a2ac36b89bc81a9f6b64f97bd2745ac951fd695fe53661ea.exe
e976a2f97fa0a949a2ac36b89bc81a9f6b64f97bd2745ac951fd695fe53661ea.exe
memory/4568-320-0x0000000074D50000-0x0000000075301000-memory.dmp
memory/4568-304-0x0000000074D50000-0x0000000075301000-memory.dmp
memory/4996-188-0x0000000005D61000-0x0000000005DD9000-memory.dmp
memory/4996-235-0x0000000005D60000-0x0000000005F60000-memory.dmp
memory/4996-138-0x00000000056A1000-0x00000000056D7000-memory.dmp
memory/4996-139-0x00000000056A1000-0x00000000056D7000-memory.dmp
memory/4996-140-0x00000000056A1000-0x00000000056D7000-memory.dmp
memory/4996-141-0x00000000056A1000-0x00000000056D7000-memory.dmp
memory/4996-142-0x00000000056A1000-0x00000000056D7000-memory.dmp
memory/4996-143-0x00000000056A1000-0x00000000056D7000-memory.dmp
memory/4996-144-0x00000000056A1000-0x00000000056D7000-memory.dmp
memory/4996-145-0x00000000056A0000-0x00000000057A0000-memory.dmp
memory/4996-147-0x00000000056A1000-0x00000000056D7000-memory.dmp
memory/4996-146-0x00000000056A0000-0x00000000057A0000-memory.dmp
memory/4996-148-0x00000000056A1000-0x00000000056D7000-memory.dmp
memory/4996-149-0x0000000005D61000-0x0000000005DD9000-memory.dmp
memory/4996-150-0x0000000005D61000-0x0000000005DD9000-memory.dmp
memory/4996-151-0x0000000005D61000-0x0000000005DD9000-memory.dmp
memory/4996-152-0x0000000005D61000-0x0000000005DD9000-memory.dmp
memory/4996-153-0x0000000005D61000-0x0000000005DD9000-memory.dmp
memory/4996-154-0x0000000005D61000-0x0000000005DD9000-memory.dmp
memory/4996-155-0x0000000005D61000-0x0000000005DD9000-memory.dmp
memory/4996-156-0x0000000005D61000-0x0000000005DD9000-memory.dmp
memory/4996-157-0x0000000005D61000-0x0000000005DD9000-memory.dmp
memory/4996-158-0x0000000005D61000-0x0000000005DD9000-memory.dmp
memory/4996-159-0x0000000005D61000-0x0000000005DD9000-memory.dmp
memory/4996-160-0x0000000005D61000-0x0000000005DD9000-memory.dmp
memory/4996-161-0x0000000005D61000-0x0000000005DD9000-memory.dmp
memory/4996-162-0x0000000005D61000-0x0000000005DD9000-memory.dmp
memory/4996-163-0x0000000005D60000-0x0000000005F60000-memory.dmp
memory/4996-164-0x0000000005D60000-0x0000000005F60000-memory.dmp
memory/4996-165-0x0000000005D61000-0x0000000005DD9000-memory.dmp
memory/4996-166-0x0000000005D61000-0x0000000005DD9000-memory.dmp
memory/4996-167-0x0000000005D61000-0x0000000005DD9000-memory.dmp
memory/4996-168-0x0000000005D61000-0x0000000005DD9000-memory.dmp
memory/4996-169-0x0000000005D61000-0x0000000005DD9000-memory.dmp
memory/4996-170-0x0000000005D61000-0x0000000005DD9000-memory.dmp
memory/4996-171-0x0000000005D61000-0x0000000005DD9000-memory.dmp
memory/4996-172-0x0000000005D61000-0x0000000005DD9000-memory.dmp
memory/4996-173-0x0000000005D61000-0x0000000005DD9000-memory.dmp
memory/4996-174-0x0000000005D60000-0x0000000005F60000-memory.dmp
memory/4996-175-0x0000000005D60000-0x0000000005F60000-memory.dmp
memory/4996-176-0x0000000005D61000-0x0000000005DD9000-memory.dmp
memory/4996-177-0x0000000005D61000-0x0000000005DD9000-memory.dmp
memory/4996-178-0x0000000005D61000-0x0000000005DD9000-memory.dmp
memory/4996-179-0x0000000005D61000-0x0000000005DD9000-memory.dmp
memory/4996-180-0x0000000005D61000-0x0000000005DD9000-memory.dmp
memory/4996-181-0x0000000005D61000-0x0000000005DD9000-memory.dmp
memory/4996-182-0x0000000005D61000-0x0000000005DD9000-memory.dmp
memory/4996-183-0x0000000005D61000-0x0000000005DD9000-memory.dmp
memory/4996-184-0x0000000005D61000-0x0000000005DD9000-memory.dmp
memory/4996-185-0x0000000005D60000-0x0000000005F60000-memory.dmp
memory/4996-186-0x0000000005D61000-0x0000000005DD9000-memory.dmp
memory/4996-187-0x0000000005D61000-0x0000000005DD9000-memory.dmp
memory/4996-136-0x00000000056A1000-0x00000000056D7000-memory.dmp
memory/4996-189-0x0000000005D61000-0x0000000005DD9000-memory.dmp
memory/4996-190-0x0000000005D61000-0x0000000005DD9000-memory.dmp
memory/4996-191-0x0000000005D61000-0x0000000005DD9000-memory.dmp
memory/4996-137-0x00000000056A1000-0x00000000056D7000-memory.dmp
memory/4996-192-0x0000000005D61000-0x0000000005DD9000-memory.dmp
memory/4996-305-0x0000000005D60000-0x0000000005F60000-memory.dmp
memory/4996-195-0x0000000005D60000-0x0000000005F60000-memory.dmp
memory/4996-196-0x0000000005D60000-0x0000000005F60000-memory.dmp
memory/4996-197-0x0000000005D61000-0x0000000005DD9000-memory.dmp
memory/4996-198-0x0000000005D60000-0x0000000005F60000-memory.dmp
memory/4996-199-0x0000000005D61000-0x0000000005DD9000-memory.dmp
memory/4996-200-0x0000000005D61000-0x0000000005DD9000-memory.dmp
memory/4996-201-0x0000000005D61000-0x0000000005DD9000-memory.dmp
memory/4996-202-0x0000000005D61000-0x0000000005DD9000-memory.dmp
memory/4996-203-0x0000000005D61000-0x0000000005DD9000-memory.dmp
memory/4996-204-0x0000000005D61000-0x0000000005DD9000-memory.dmp
memory/4996-205-0x0000000005D61000-0x0000000005DD9000-memory.dmp
memory/4996-206-0x0000000005D60000-0x0000000005F60000-memory.dmp
memory/4996-207-0x0000000005D61000-0x0000000005DD9000-memory.dmp
memory/4996-216-0x0000000074D50000-0x0000000075301000-memory.dmp
memory/4996-217-0x0000000005D60000-0x0000000005F60000-memory.dmp
memory/4996-218-0x0000000005D60000-0x0000000005F60000-memory.dmp
memory/4996-219-0x0000000005D60000-0x0000000005F60000-memory.dmp
memory/4996-193-0x0000000005D61000-0x0000000005DD9000-memory.dmp
memory/4996-236-0x0000000005D60000-0x0000000005F60000-memory.dmp
memory/4996-237-0x0000000005D60000-0x0000000005F60000-memory.dmp
memory/4996-248-0x00000000056A0000-0x00000000057A0000-memory.dmp
memory/4996-249-0x00000000056A0000-0x00000000057A0000-memory.dmp
memory/4996-251-0x0000000005D60000-0x0000000005F60000-memory.dmp
memory/4996-252-0x0000000005D60000-0x0000000005F60000-memory.dmp
memory/4996-263-0x0000000005D60000-0x0000000005F60000-memory.dmp
memory/4996-264-0x0000000005D60000-0x0000000005F60000-memory.dmp
memory/4996-266-0x0000000005D60000-0x0000000005F60000-memory.dmp
memory/4996-276-0x0000000005D60000-0x0000000005F60000-memory.dmp
memory/4996-277-0x0000000005D60000-0x0000000005F60000-memory.dmp
memory/4996-278-0x0000000005D60000-0x0000000005F60000-memory.dmp
memory/4996-135-0x00000000056A1000-0x00000000056D7000-memory.dmp
memory/4996-279-0x0000000005D60000-0x0000000005F60000-memory.dmp
memory/4996-287-0x0000000005D60000-0x0000000005F60000-memory.dmp
memory/4996-289-0x0000000005D60000-0x0000000005F60000-memory.dmp
memory/4996-290-0x0000000005D60000-0x0000000005F60000-memory.dmp
memory/4996-293-0x0000000005D60000-0x0000000005F60000-memory.dmp
memory/4996-301-0x0000000005D60000-0x0000000005F60000-memory.dmp
memory/4996-303-0x0000000005D60000-0x0000000005F60000-memory.dmp
memory/4996-302-0x0000000005D60000-0x0000000005F60000-memory.dmp
memory/4996-133-0x00000000056A1000-0x00000000056D7000-memory.dmp
memory/4996-194-0x0000000005D61000-0x0000000005DD9000-memory.dmp
memory/4996-306-0x0000000005D60000-0x0000000005F60000-memory.dmp
memory/4996-307-0x0000000005D60000-0x0000000005F60000-memory.dmp
memory/4996-308-0x0000000005D60000-0x0000000005F60000-memory.dmp
memory/4996-309-0x0000000005D60000-0x0000000005F60000-memory.dmp
memory/4996-310-0x0000000005D60000-0x0000000005F60000-memory.dmp
memory/4996-311-0x0000000005D60000-0x0000000005F60000-memory.dmp
memory/4996-312-0x0000000005D60000-0x0000000005F60000-memory.dmp
memory/4996-313-0x0000000005D60000-0x0000000005F60000-memory.dmp
memory/4996-314-0x0000000005D60000-0x0000000005F60000-memory.dmp
memory/4996-315-0x0000000005D60000-0x0000000005F60000-memory.dmp
memory/4996-316-0x0000000005D60000-0x0000000005F60000-memory.dmp
memory/4996-317-0x0000000005D60000-0x0000000005F60000-memory.dmp
memory/4996-318-0x0000000005D60000-0x0000000005F60000-memory.dmp
memory/4996-319-0x0000000074D50000-0x0000000075301000-memory.dmp
memory/4996-132-0x0000000074D50000-0x0000000075301000-memory.dmp